Mastodawn

Josh Bressers 3d ago

daniel:// stenberg://

a CVE dispute. What a great system.

https://daniel.haxx.se/blog/2026/06/24/a-cve-dispute/

a CVE dispute

A few years years ago the curl project signed up and became a CNA. This means that we are masters of and can allocate our own CVE identifiers. For any security problems within our territory, it is we who decides if the issue should get a CVE our not. No more bogus CVEs. 57 CVEs … Continue reading a CVE dispute →

daniel.haxx.se

Master of Potate 🥔4d ago

@bagder Do you get something if you find a CVE worthy bug?

daniel:// stenberg://4d ago

@chris yes, you get that awesome sensation that you help improving curl and a thank you and credits in the advisory

Master of Potate 🥔4d ago

@bagder Ah. I was just wondering why someone would be so instant that the bug got a CVE. It sounds annoying. I hate explaining myself multiple times without a feedback.

daniel:// stenberg://4d ago

@chris I cannot explain why they pushed for this so hard.

Violet/Multi (migrated account)4d ago

@bagder @chris Anecdote: A friend recently handled a security report in a popular free project; they don't assign CVEs ever. The reporter insisted on receiving one to build recognition for their CV

spartanatreyu 4d ago

@bagder @chris My guess is resume padding

@chris @bagder There's a meme going around that CVEs are resume/CV fodder for budding hackers looking to break into infosec.

Maybe I'm biased because nothing I reported publicly ended up with a CVE, but if I'm hiring I'll look at research and judge it on its merits, not whether it got assigned a CVE or not.

Wolf480pl 4d ago

@fwaggle
what if HR comes to you and says "I have 100 applicants for this position, and I suspect most of them are severely underqualified. How do I filter out the obviously underqualified ones so that I can give you a managable number of candidates for technical interview?"
@chris @bagder

@wolf480pl @chris @bagder I don't know a generic answer to that question, we've had a few situations like that where we can give TA specific things to ask about (all specific to our org and the role), but I don't think a CVE being assigned to the applicant is particularly helpful there though?

Not sure I'd want to work for any org with "at least x CVEs to ride" as part of the hiring process, but I can afford to be picky right now.

I agree that it’s not worthy of a CVE. In addition to your reasoning I see another argument for why a CVE is not warranted. Even if an attacker could make resolution work for this invalid hostname, what attack could they actually perform? If they control the wildcard certificate they can use it for any subdomain, so what sort of attack can be performed using the invalid domain which couldn’t have been achieved using a valid subdomain?

There is one thing about the bug which puzzles me. I would have expected the validation of domain matching certificate to have been performed by the TLS library and not in curl, so what’s the reason this is a bug in curl rather than the library?

daniel:// stenberg://4d ago

@kasperd for OpenSSL we have curl code to do the verification because they did not provide such a function for a very long time, and I don't even know the status of any such now

Mark Esler 4d ago

@bagder would nominating https://www.cve.org/PartnerInformation/ListofPartners/partner/redhat as your CNA's root help avoid MITRE?

MITRE sits above other roots, but if the processes flows to Pete's group first it might squelch the noise https://www.cve.org/programorganization/Structure

daniel:// stenberg://4d ago

@eslerm our root is Red Hat already. I don't know why MITRE was involved here

Mark Esler 4d ago

ClickyMcTicker 3d ago

@bagder @eslerm Perhaps they pitched a fit to Red Hat & appealed it up to MITRE. I’m not familiar with the process, but this seems like the type of person to use it. They had an AI find the bug and write the report, then went back to it to seek validation. Meanwhile, their AI entirely missed the invalid DNS issue. Meanwhile, I brought the same URL to ChatGPT and it pointed out the invalidity immediately.

AI is rotting brains.

Prometheus 3d ago

CVE as a system works when the assigning CNA has skin in the game. When the CNA is the vendor and the bug reporter is an outsider, "dispute process" mostly means waiting until the vendor loses interest in disagreeing.